libuv before 0.10.34 does not properly drop group privileges, which allows context-dependent attackers to gain privileges via unspecified vectors.

The remote host is affected by the vulnerability described in GLSA-201611-10 (libuv: Privilege escalation)

    It was discovered that libuv does not call setgroups before calling       setuid/setgid.  If this is not called, then even though the uid has been       dropped, there may still be groups associated that permit superuser       privileges.
  Impact :

    Context-dependent attackers could escalate privileges via unspecified       vectors.
  Workaround :

    There is no known workaround at this time.

Updated nodejs package fixes security vulnerability :

It was found that libuv does not call setgoups before calling setuid/setgid. This may potentially allow an attacker to gain elevated privileges (CVE-2015-0278).

The libuv library is bundled with nodejs, and a fixed version of libuv is included with nodejs as of version 0.10.37. The nodejs package has been updated to version 0.10.38 to fix this issue, as well as several other bugs.

Nodejs releases reports : CVE-2015-0278 This may potentially allow an attacker to gain elevated privileges.

It was found that libuv does not call setgoups before calling setuid/setgid. This may potentially allow an attacker to gain elevated privileges.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

# nodejs

  - tls: re-add 1024-bit SSL certs removed by f9456a2 (Chris     Dickinson)

  - timers: don't close interval timers when unrefd (Julien     Gilli)

  - timers: don't mutate unref list while iterating it     (Julien Gilli)

  - child_process: check execFile args is an array (Sam     Roberts)

  - child_process: check fork args is an array (Sam Roberts)

  - crypto: update root certificates (Ben Noordhuis)

  - domains: fix issues with abort on uncaught (Julien     Gilli)

  - timers: Avoid linear scan in _unrefActive. (Julien     Gilli)

  - timers: fix unref() memory leak (Trevor Norris)

  - debugger: fix when using 'use strict' (Julien Gilli)

# libuv

  - linux: fix epoll_pwait() regression with < 2.6.19 (Ben     Noordhuis)

  - linux: fix epoll_pwait() sigmask size calculation (Ben     Noordhuis)

  - linux: fix sigmask size arg in epoll_pwait() call (Ben     Noordhuis)

  - linux: handle O_NONBLOCK != SOCK_NONBLOCK case (Helge     Deller)

  - doc: update project links (Ben Noordhuis)

  - unix: add flag for blocking SIGPROF during poll (Ben     Noordhuis)

  - unix, windows: add uv_loop_configure() function (Ben     Noordhuis)

# v8

  - Fix debugger and strict mode regression (Julien Gilli)

  - don't busy loop in cpu profiler thread (Ben Noordhuis)

  - add api for aborting on uncaught exception (Julien     Gilli)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
94936	GLSA-201611-10 : libuv: Privilege escalation	Nessus	Gentoo Local Security Checks	critical
83274	Mandriva Linux Security Advisory : nodejs (MDVSA-2015:228)	Nessus	Mandriva Local Security Checks	critical
82063	FreeBSD : libuv -- incorrect revocation order while relinquishing privileges (996bce94-d23d-11e4-9463-9cb654ea3e1c)	Nessus	FreeBSD Local Security Checks	critical
81840	Fedora 22 : compat-libuv010-0.10.34-1.fc22 (2015-2563)	Nessus	Fedora Local Security Checks	critical
81839	Fedora 20 : libuv-0.10.34-1.fc20 / nodejs-0.10.36-3.fc20 / v8-3.14.5.10-17.fc20 (2015-2310)	Nessus	Fedora Local Security Checks	critical
81584	Fedora 21 : libuv-0.10.34-1.fc21 / nodejs-0.10.36-3.fc21 / v8-3.14.5.10-17.fc21 (2015-2313)	Nessus	Fedora Local Security Checks	critical

Detections

Analytics

CVE-2015-0278

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical